The Grav API plugin accepts a JWT provided in the ?token= query parameter on every /api/v1 route, including those that modify data, which is a CWE‑598 input validation weakness that writes valid access tokens to server logs, CDN logs, proxy logs, browser history, and Referer headers. As a result, valid access tokens are exposed to anyone who can read those records. An attacker who obtains a logged token can impersonate the owner and perform any API action granted to the token holder, effectively bypassing authentication requirements and potentially altering site content.

Versions of the Grav API plugin older than 1.0.0‑rc.16 are affected. The issue applies to installations of Grav CMS that use the getgrav:grav‑plugin‑api plugin before that release.

The CVSS score of 7.5 indicates a high severity risk. The EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, implying limited public exploitation so far. Exploitation requires that an attacker has access to logs, CDN records, or Referer headers, or can induce a user’s browser to send a request containing a leaked token. If such exposure occurs, the attacker can reuse the token to gain the bearer’s privileges, which can include full API access and state changes.